@bobfrankston/mailx-types 0.1.69 → 0.1.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.69",
+  "version": "0.1.71",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -77,6 +77,15 @@ const ASSOCIATION_RULES = [
     /^SEM_URIBL/,
     /^SPAMHAUS_/,
     /^RCVD_IN_(SBL|XBL|PBL|BL_SPAMCOP|SORBS|BRBL|VALIDITY|MSPIKE_[LZ])/,
+    // Blocklist rules that happen to live under other prefixes. KAM_*URIBL_*
+    // ("Body contains URI listed in PCCC WILD RBL", 9.0) and SH_HBL_EMAILS
+    // ("Email address listed in email blocklist", 8.0) are the same kind of
+    // evidence as URIBL_SBL — somebody else's list, about a host or address
+    // the message mentions — and they were the bulk of what still cautioned a
+    // proved sender: a Business Insider newsletter, an MIT cancer-center
+    // invitation, a campaign mailing. KAM_INFOUSMEBIZ judges the TLD a domain
+    // lives in, which is guilt by neighbourhood.
+    /^KAM_(BODY_|FROM_)?URIBL/, /^SH_HBL/, /^KAM_INFOUSMEBIZ$/,
 ];
 /** The shape of mass mailing: bulk-detection networks, marketing markup, list
  *  plumbing. A score built entirely from these is a bulk verdict however high
@@ -94,6 +103,10 @@ const BULK_RULES = [
     /^URIBL_(GREY|CSS|BLOCKED|CT_SURBL)/, /^SH_BODYURI/,
     /^HEADER_FROM_DIFFERENT_DOMAINS$/, // every ESP on earth trips this
     /^MPART_ALT_DIFF/, /^TVD_/, /^T_REMOTE_IMAGE$/, /^UNPARSEABLE_RELAY$/,
+    // Branded ESP click-trackers. Not open redirectors (URI_PHP_REDIR and
+    // friends stay unclassified): these are the sending platform's own
+    // tracking domain, which is mass-mail machinery by definition.
+    /^GB_AWSTRACK/, /AWSTRACK/, /^GB_SENDGRID/, /^GB_MAILCHIMP/,
 ];
 /** Passes, whitelistings, and Bayes' own opinion — informational, and in
  *  BAYES_00's case exculpatory. `DKIM_INVALID` lives here rather than in the
@@ -237,9 +250,27 @@ function analyzeServerSpam(input) {
     // of a report is not evidence the rule was free.
     const scored = (r) => !(r.score <= 0);
     const present = (cls) => rules.some(r => r.cls === cls && scored(r));
+    // An unknown rule keeps a proved sender at caution only if it could have
+    // flagged the message BY ITSELF. Presence was too crude: an IEEE
+    // conference announcement (Bob 2026-08-28) scored 4.5 of 4.5 on DCC 3.0 +
+    // marketing 1.0 + 1.5 for GB_AWSTRACK_REDIR — Amazon SES's click-tracker,
+    // which every bulk mailer on earth routes through — and the 1.5 alone
+    // pushed a DMARC-proved announcement into "check this message before
+    // acting on it". Meanwhile KAM_BENEFICIARY, the case this rule exists for,
+    // is worth 10.0 on its own.
+    //
+    // The comparison is against the SERVER'S OWN threshold, so this adds no
+    // constant to tune: "enough to condemn" already has a number, and it is
+    // the one the server used. Unscored rules (no X-Spam-Report) make the sum
+    // unknown, and unknown stays cautious.
+    const unknown = rules.filter(r => r.cls === "other" && scored(r));
+    const unknownWeight = unknown.reduce((sum, r) => sum + r.score, 0);
+    const unknownCouldFlagAlone = !unknown.length ? false
+        : !Number.isFinite(unknownWeight) || !Number.isFinite(threshold) ? true
+            : unknownWeight >= threshold;
     const kind = (dmarc.authFailures.length || present("forgery")) ? "forgery"
         : present("association") ? "association"
-            : present("other") ? "unclassified"
+            : unknownCouldFlagAlone ? "unclassified"
                 : rules.length ? "bulk"
                     : "unclassified";
     // Two proofs SpamAssassin states in its own rule list, which mail that